Always a good question. A group of security people with experience in the scenario was trading about it on a conference a while ago. I far from knew everyone i

Always a good question. A group of security people with experience in the scenario was trading about it on a conference a while ago. I far from knew everyone in the group. Always a risky answer, of course, especially from some random person on HN. But in this case, it makes sense, and a 'long arm', international treatment is a general solution for powerfull entities needing to break a law. I don't think you'll find anyone going officially on record as breaking the law, however. Most companies won't even let it leak they're a victim.